CS-580K/480K Advanced Topics in Cloud Computing. Network Virtualization

Transcription

1 CS-580K/480K Advanced Topics in Cloud Computing Network Virtualization 1

2 Network Diagram of A Company 2

3 University Network Topology 3

4 Home Network Topology 4

5 How to Fit Multiple of Them to Cloud? 5

6 How to fit the company s network to the cloud environment? 6

7 Network Diagram of A Cloud-based Data Center 7

8 Data Centers A data center has many racks. A rack has servers. The servers in a rack connect to a e.g., 48-port top of rack (ToR) switch. 8

9 Data Centers 9

10 Data Center Network Design (Prior VMs) 10

11 Data Center Network Design with VMs 11

12 Problem: Isolation All VMs can talk to each other by default. You don't want someone in engineering screwing up the finance network. You don't want a break-in to your production website to steal human resources data. Some switches have isolation features but: There are hundreds of switches to set up. Do we want to manually configure them? How about VMs of the same machine 12

13 Goals vm vm vm vm Virtual Network 1 Virtual Network 2 Router 13

14 VLANs A VLAN partitions a physical Ethernet network into isolated virtual Ethernet networks 14

15 VLANs 15

16 VLANs Problems Visibility The Internet is an L3 network. When a packet crosses the Internet, it loses all its L2 headers, including the VLAN tag. You lose all the isolation when your traffic crosses the Internet. Limited number (4096) Static allocation 16

17 Solution: Network Virtualization 17

18 Solution: Network Virtualization 18

19 Generic Routing Encapsulation (GRE) Tunneling Encapsulation with delivery header The addresses in the delivery header are the addresses of the head-end and the tail-end of the tunnel Delivery header / GRE / Private network site / tunnel /16 Public Network /16 Private network site Virtual Private Networks (VPN) CN8816: Network Security 19

20 Path of a Packet (No Tunnel) A packet from one VM to another passes through a number of switches along the way Each switch only looks at the destination MAC address to decide where the packet should go 20

21 Path of a Packet (Via Tunnel) 21

22 Challenges Setting up the tunnels: Initially After VM startup/shutdown After VM migration Handling network failures Monitoring, administration Administration Use a central controller to set up the tunnels 22

23 In Virtualization, How? 23

24 A Distributed Network Virtualization 24

25 Controller Duties Monitor: Physical network VM locations, states Control: Tunnel setup All packets on virtual and physical network Virtual/physical mapping Tells OVS running everywhere else what to do 25

26 Open vswitch Ethernet switch implemented in software Can be remotely controlled Tunnels (GRE and many others) Integrates with VMMs, e.g. XenServer, KVM Free and open source Optimized Enterprise level soltuon 26

27 OpenFlow in the Data Center Tunnel ovs ovs Machine 1 Machine 2 VM1 VM Controller 27

28 OpenFlow in the Data Center 28

29 Open vswitch: Design Overview 29

30 Open vswitch: Design Details 30

31 vm vm Virtual Network 1 31

32 ovs ovs ovs ovs ovs ovs ovs ovs vm1 vm2 vm3 vm4 vm5 32

33 vm vm vm vm Virtual Network 1 Virtual Network 2 Router 33

34 Software Routers ovs ovs ovs ovs ovs ovs ovs ovs Net1 Gate Way Net2 Gate way vm1 vm1 vm2 vm2 vm3 vm3 vm4 vm5 34

35 OpenFlow: Another Use 35

36 Within a Single Machine, Isoaltion? vm1 vm2 vm3 vm4 vm5 vm6 OVS Using VLANs 36

37 VXLAN: Virtual extensible LAN IETF Draft Standard A type of network overlay technology that encapsulates L2 frames as UDP packets 37

38 VXLAN: Virtual extensible LAN Outer DMAC Outer SMAC Outer 802.1Q Outer DIP Outer SIP Outer UDP VXLAN Header Inner DMAC Inner SMAC Inner 802.1Q Original Payload Outer UDP/IP Packet Inner Ethernet Frame 38

39 VXLAN: Virtual extensible LAN VNI VXLAN Network Identifier 24 bit number (16M+ unique identifiers) Part of the VXLAN Header Similar to VLAN ID Limits broadcast domain VTEP VXLAN Tunnel End Point Originator and/or terminator of VXLAN tunnel for a specific VNI Outer DIP/Outer SIP 39

40 VXLAN: Virtual extensible LAN Sending a packet Packet is encapsulated for destination VTEP with configured VNI and sent to destination Destination VTEP un-encapsulates the packet and the inner packet is then processed by the receiver 40

41 Network Virtualization The ability to create logical, virtual networks that are decoupled from the underlying network hardware to ensure the network can better integrate with and support increasingly virtual environments. 41

42 What to Virtualize? 5 4 Application (HTTP) Transport Layer L4 and up services, like firewall and load balancing Network Layer Data Link Physical Link L2-3 services, like switching and routing 42

43 In Summary Companies spread VMs across data centers. Ordinary networking exposes differences between VMs in the same data center and those in different data centers. Tunnels can hide the differences. A controller and OpenFlow switches at the edge of the network can set up and maintain the tunnels. 43